Activity logs show a large amount of data downloaded from a company server to an
employee’s workstation overnight. Upon further investigation, the technician identifies the
data as being outside the scope of the employee’s regular job functions. Which of the
following steps should the technician take NEXT?
A.
Report through proper channels
B.
Document the changes
C.
Continue to track more evidence
D.
Preserve the chain of custody